b5213f6184a478c5b710145aae7c06a7dc9c5a9ebeac78c6af1206221dcf96fd

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
20/04/2024, 08:06

Target

fc4de7b09628874fae63d47a95eb8040_JaffaCakes118.dll
Size

41KB
MD5

fc4de7b09628874fae63d47a95eb8040
SHA1

9df165aff93ce015d76b948468b6c0cae72629f3
SHA256

b5213f6184a478c5b710145aae7c06a7dc9c5a9ebeac78c6af1206221dcf96fd
SHA512

90d5a4f573c7e309e3f402c61eacbe84238163e3be3d296d32cfd16ff4845313ac74ea6527e32a561086ed04d2652c12ab3e5f0636346d7a19b2b247c0a140ba
SSDEEP

768:y88yiuS2uTiPoJnGeiAjsqp+MDJPi3WNRGgpw1TdtcCAY:y46T3JnGe/jsqQiJPiGNR1i1TTQY

Score

1^/10

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2900 wrote to memory of 3036	2900	rundll32.exe	87
PID 2900 wrote to memory of 3036	2900	rundll32.exe	87
PID 2900 wrote to memory of 3036	2900	rundll32.exe	87

C:\Windows\system32\rundll32.exe
rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc4de7b09628874fae63d47a95eb8040_JaffaCakes118.dll,#1
1⤵
- Suspicious use of WriteProcessMemory
PID:2900
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe C:\Users\Admin\AppData\Local\Temp\fc4de7b09628874fae63d47a95eb8040_JaffaCakes118.dll,#1
  2⤵
  PID:3036